CVE-2025-26660: SAP Fiori Auth Bypass Vulnerability

CVE-2025-26660 Overview

CVE-2025-26660 affects SAP Fiori applications that use the posting library. The applications fail to configure security settings correctly during setup, leaving them at default or inadequately defined values. An authenticated attacker with low privileges can exploit this misconfiguration to bypass access controls within the application. Successful exploitation allows the attacker to modify data belonging to other users [CWE-639]. Confidentiality and availability are not impacted. The issue is categorized as an authorization flaw stemming from insecure default configuration in the posting library used by multiple SAP Fiori applications.

Critical Impact
An authenticated attacker with low privileges can bypass access controls in SAP Fiori applications and modify data owned by other users, breaking integrity assumptions in business processes.

Affected Products

SAP Fiori applications that consume the posting library
SAP business processes relying on posting library authorization checks
Deployments configured with default security settings for the posting library

Discovery Timeline

2025-03-11 - CVE-2025-26660 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26660

Vulnerability Analysis

The vulnerability is an Authorization Bypass Through User-Controlled Key [CWE-639]. SAP Fiori applications built on the posting library do not enforce object-level authorization consistently. During application setup, security settings remain at defaults or are inadequately defined. As a result, authorization decisions rely on identifiers that an authenticated user can influence. A low-privileged user can therefore reference posting objects that belong to other users and perform write operations against them. The flaw impacts integrity only; the attacker cannot read protected data or degrade availability of the application.

Root Cause

The root cause is insecure default configuration in the posting library. The library exposes posting operations without binding authorization checks to the requesting user's context. Because setup does not enforce a secure baseline, deployed Fiori applications inherit weak authorization defaults. Object ownership is not validated against the caller before write actions are executed.

Attack Vector

Exploitation requires network access to the Fiori application and valid low-privileged credentials. No user interaction is required. The attacker submits requests to posting endpoints while substituting object identifiers referring to records owned by other users. Because the posting library does not verify ownership, the requests succeed and modify targeted records. See the SAP Security Patch Day advisory and SAP Note #3557655 for the vendor's technical description.

Detection Methods for CVE-2025-26660

Indicators of Compromise

Unexpected modifications to Fiori posting objects where the last-modified user does not match the object owner.
HTTP requests to Fiori posting endpoints referencing object identifiers outside the caller's normal working set.
Audit log entries showing write operations by low-privileged accounts against records they did not create.

Detection Strategies

Correlate Fiori application logs with identity context to flag write actions where the acting user differs from the record owner.
Baseline typical posting object ranges accessed per user role and alert on deviations that suggest identifier enumeration.
Review SAP security audit logs for repeated authorization decisions against posting endpoints from the same session.

Monitoring Recommendations

Ingest SAP Fiori access logs and NetWeaver security audit logs into a centralized analytics platform for continuous review.
Monitor patch level of the posting library across all Fiori-enabled systems and alert on drift from the patched baseline.
Track failed and successful authorization events on posting APIs to identify probing behavior.

How to Mitigate CVE-2025-26660

Immediate Actions Required

Apply the fix referenced in SAP Note #3557655 to all Fiori applications that use the posting library.
Inventory Fiori applications and confirm which instances consume the posting library and require remediation.
Review privileged and low-privileged role assignments to reduce the population of users who could exploit the flaw pre-patch.

Patch Information

SAP addresses CVE-2025-26660 through the security note published on SAP Security Patch Day. Administrators should apply SAP Note #3557655 and validate that the posting library enforces authorization checks after deployment. Refer to the SAP Security Patch Day portal for the complete patch bundle and prerequisites.

Workarounds

Restrict network access to affected Fiori applications to trusted user segments until the patch is deployed.
Tighten role and authorization object assignments so fewer users hold the low-privilege access required to reach posting endpoints.
Enable enhanced logging on Fiori posting services to increase visibility while remediation is in progress.

bash

# Configuration example
# Verify SAP Note #3557655 application status on the target system
# (run in SAP GUI transaction SNOTE)
SNOTE -> Goto -> Note Browser -> Filter: 3557655
# Confirm status: "Completely implemented"